CVE-2021-3682

NameCVE-2021-3682
DescriptionA flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2753-1, DLA-3099-1, DSA-4980-1, ELA-481-1
Debian Bugs991911

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)jessie, jessie (lts)1:2.1+dfsg-12+deb8u23fixed
stretch (security)1:2.8+dfsg-6+deb9u17fixed
stretch (lts), stretch1:2.8+dfsg-6+deb9u19fixed
buster1:3.1+dfsg-8+deb10u8vulnerable
buster (security)1:3.1+dfsg-8+deb10u12fixed
bullseye1:5.2+dfsg-11+deb11u3fixed
bullseye (security)1:5.2+dfsg-11+deb11u2fixed
bookworm1:7.2+dfsg-7+deb12u5fixed
trixie1:8.2.1+ds-2fixed
sid1:8.2.2+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusourcejessie1:2.1+dfsg-12+deb8u21ELA-481-1
qemusourcestretch1:2.8+dfsg-6+deb9u15DLA-2753-1
qemusourcebuster1:3.1+dfsg-8+deb10u9DLA-3099-1
qemusourcebullseye1:5.2+dfsg-11+deb11u1DSA-4980-1
qemusource(unstable)1:6.0+dfsg-3991911

Notes

https://gitlab.com/qemu-project/qemu/-/issues/491
Introduced by: https://gitlab.com/qemu-project/qemu/-/commit/b2d1fe67d09d2b6c7da647fbcea6ca0148c206d3 (v1.4.0-rc0)
Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5e796671e6b8d5de4b0b423dce1b3eba144a92c9 (v6.1.0-rc2)

Search for package or bug name: Reporting problems